How scammers could be using social media to personalize fake CRA threats

At a time when she should only be worried about spending time with her newborn son, Joanna Cicino is concerned about how a scammer gained access to her personal information.

She received an automated message Friday from someone who sounded like a detective.

"He said that he needed either me or my attorney to call back to discuss my maternity leave and my unemployment," she told CBC Toronto. The caller said he was from the Canada Revenue Agency (CRA).

"Towards the end, he said that if I didn't call back that would basically be in my worst interests … the very last thing he said was, 'Good luck.'"

• CRA scam adapting to go after former victims a 2nd time, RCMP warns

• Arrests of 70 in India linked to decrease in CRA phone scams, RCMP says

• 'Big game changer': CRA phone scam revs up as fraudsters start calling cellphones

Cicino looked up the number online and found no connection to the CRA. It seemed strange, since she'd filed the paperwork for her leave months prior with no problems.

Curious, she phoned back.

"Someone immediately picked up the phone, there was no automated message or anything like that," she said.

She asked why he called, and he said he needed her information.

"So, I said, 'Well, what department are you from?' … and he hung up on me," Cicino said. "It was very scary because, how did he know that I was on mat leave? I felt like I was actually targeted."

In an email to CBC Toronto, the CRA said they are not aware of any unauthorized access of taxpayer information, such as a hack.

To warn others, Cicino posted about the call on her new mom's group on Facebook. 

Then someone pointed out Cicino had pictures of herself, her baby and her husband on the site.

Sourcing info from social media

Those pictures could've given this person a way to personalize his attack, according to Jessica Gunson, the acting call centre and intake unit manager at the Canadian Anti-Fraud Centre (CAFC). 

There's no way to know for sure, she said, but people have previously used Facebook and social media to make their calls sound more authentic.

"Anywhere your information's available, you could become a target," she said. "That's an avenue the criminals can use, especially when they can really hone in on a specific target."

In other cases, people have used names from online directories, registrations and obituaries, she said.

In relation to this particular scammer, Gunson said they've received 20 calls in July alone to complain about the same number.

Typically, the caller will either leave a message or speak directly to the victim, claiming back taxes are owed to the CRA. They add that if the person doesn't take immediate action, they'll be dealing with lawyers, charges and even a possible arrest. 

Cicino's case is unique, though. Gunson said she hasn't heard of any other calls where the scammer mentions maternity leave. It could be that the caller was missing that piece of information, or he wanted to use it for a follow-up call with Cicino, she said.

'Trust no one'

Gunson said the CAFC is inundated with calls describing several variations of the scheme.

Some just ask the person to clarify personal information, which could potentially lead to identity theft.

Another popular scam is contacting the victim with a text message that looks similar to an e-transfer, saying their refund is now available and to click on the attached link.

Another is a message purporting to be from a tech company — Gunson specifically mentioned Rogers — saying the person is entitled to a refund.

• 'He was just trying to brag,' says Toronto cop who went after CRA scammer

• ​How a Woodbridge, Ont., woman got a fraudster to admit his CRA threat was a scam

"Trust no one," is Gunson's advice. Hang up the phone, or better yet, speak with someone in-person to get verification. 

When it comes to social media, she says:

• Ensure all your settings are private. 
• Change your passwords often.
• Only let people you trust see your pages, as victims can be completely random.

"Your personal information needs to be treated like money and you need to protect it as such," Gunson said. "It's really listening to your gut and noticing those red flags, and when something doesn't sound right, it's okay to hang up the phone and it's okay to ask questions."

The CRA said one of those red flags is if the person asks for payment in prepaid credit cards or gift cards, for information about your passport, health card or driver's licence, or if the payment comes in the form of an Interac e-transfer.

While Cicino avoided the scam itself, she said she has tried to protect herself by changing all of her privacy settings.

When asked about the particular phone number, RCMP Staff Sgt. Julie Gagnon said they can't comment on whether they're conducting an investigation. But Gagnon did say they have not laid any charges.